An improper link resolution flaw in Hugo versions prior to 0.167.0 allows a malicious theme or module to create a symbolic link or NTFS junction at a virtual ancestor directory. During the build process, Hugo follows these links and can read or publish files that reside outside the intended theme root, enabling disclosure of arbitrary files within the build environment.

Users of the Hugo static site generator from the gohugoio project are affected by this issue. The vulnerability exists in releases from v0.162.0 through v0.166.x and is fixed in version 0.167.0 and later. The product is identified by the cpe:2.3:a:gohugo:hugo and the fix is available in newer community releases.

The vulnerability carries a CVSS score of 6.7, indicating a moderate level of risk. EPSS data are not available and the issue is not listed in CISA's KEV catalog. The likely attack vector involves an attacker controlling a theme or module that places a symlink or NTFS junction pointing to a location outside the theme root; when the site is built, Hugo resolves the link and includes the external file in the published output, granting the attacker read access to arbitrary files. The flaw does not provide code execution or privilege escalation beyond the build context, but the potential for sensitive data exposure makes it significant.